Unable to disable/remove 3rd party driver without BSOD

Discussion in 'Windows 10' started by MonarchX, Apr 22, 2019.

  1. MonarchX

    MonarchX MDL Expert

    May 5, 2007
    1,732
    313
    60
    I thought AOMEI Backupper wouldn't be as much of bloatware as Acronis True Image and I was wrong. I installed it, then uninstalled it, but one driver file remains - ambakdrv.sys.

    If I remove that file or remove its registry entries opr disable it in Autoruns, then I get a BSOD upon boot: "INACCESSIBLE BOOT DEVICE".

    It is set to load during boot. Process Hacker reports it as a "Boot Start" driver. It cannot be stopped from running once OS is loaded, but it can be removed in Safe Mode or with Unlocker. Once removed, the "INACCESSIBLE BOOT DEVICE" BSOD appears during OS booting after a restart. Removing it pretty much breaks the OS. The same thing happens if I search for that driver in registry and remove entries with "ambakdrv" in them. I use RegScanner for that.

    How can I get rid of that driver then? What makes the OS require that file for booting?
     
  2. TairikuOkami

    TairikuOkami MDL Expert

    Mar 15, 2014
    1,172
    1,054
    60
    Have you tried disabling it prior to removing it?
    Code:
    reg add "HKLM\System\CurrentControlSet\Services\ambakdrv" /v "Start" /t REG_DWORD /d "4" /f
     
  3. kaljukass

    kaljukass MDL Guru

    Nov 26, 2012
    3,394
    1,322
    120
    #3 kaljukass, Apr 22, 2019
    Last edited: Apr 22, 2019
    @MonarchX
    You are right in that sense that it is not a Windows file and it doesn't have to be there, but removing it can't cause a BSOD unless you have any other problems with Windows.
    Try to fix Windows at first.
    See what sfc.exe /scannow says
    Ie run at first cmd.exe as admin and then sfc.exe /scannow. If there are errors, what cannot fix, You must find another method how repair them.
    To get error log on Your desktop, make this .bat file (name for example sfcdetails.bat)
    Code:
    @echo off
    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt
    Start notepad "%userprofile%\Desktop\sfcdetails.txt"
    exit
    or run this command
    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt

    If this is done and all Windows errors are fixed, then can go on with removing this and maybe also remove some other unnecessary files.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. dasag

    dasag MDL Junior Member

    Mar 9, 2014
    67
    9
    0
    this is a known problem.. search for "ambakdrv" on google and its all over the internet.

    i uninstalled backerupper months ago and didnt realize it had left its drivers behind and it was still running the service on startup.

    i removed the ambakdrv driver in regedit rebooted and got the bsd. i had to reimage to get back on line. seems that ambakdrv shares or hijacked some dlls with windows drivers.

    i just disabled the service and it restarts ok. ambakdrv is still in my system but i guess not doing anything so i'll just leave it there. definately annoying to have those leftovers though.
     
  5. s1ave77

    s1ave77 Has left at his own request

    Aug 15, 2012
    16,104
    24,378
    340
    That's the hook with Imaging tools when installed and the reason smart people use cold disk booting (PE based) instead.

    If you want the feature to Image a running system, the backup software needs to hijack any system driver and run an own instance of it. Uninstalling those is well-nigh impossible.

    To uninstall, reinstall freshly :cool2:.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. MonarchX

    MonarchX MDL Expert

    May 5, 2007
    1,732
    313
    60
    Yeah, using bootable Acronis True Image 2019 flash drive to make backups is what I was doing before this because installable Acronis True Image 2019 would run a ton of drivers and services n the background that coulld not be removed or disabled. I fooled myself into thinking that AOMEI Backupper was different... There has to be a way to UNhijack whaterver was hikacked. Some sort of a cleanup tool could probably remove that file. Its 50KB in size, unllikely to slow down the OS, but still dirty... AOMEI Backupper forums are not working for me... I guess I can write to them. I wonder what excuse they are going to provide.
     
  7. kaljukass

    kaljukass MDL Guru

    Nov 26, 2012
    3,394
    1,322
    120
    This is a pointless activity. It's been told them thousands of times, and if you're looking for, you'll find tons of articles about the same problem. I read them just when you talked about your problem.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. MonarchX

    MonarchX MDL Expert

    May 5, 2007
    1,732
    313
    60
    Why? Are you telling me once a driver is hijacked, it can no longer be cleaned up?
     
  9. kaljukass

    kaljukass MDL Guru

    Nov 26, 2012
    3,394
    1,322
    120
    • You can do it and nothing prohibits You doing what ever You want with it. If this software is removed, You can and not only can but You should remove it.
    • But I just wanted to say that this is one old problem and hundreds of articles have been written about it and how to remove etc. Also has been many times already reported.
    • But this is not your problem.
      Your problem is that Your Windows is damaged and You must fix it at first.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. MonarchX

    MonarchX MDL Expert

    May 5, 2007
    1,732
    313
    60
    Winbdows is damaged because AOMEI Backupper driver hijacked some Windows driver. This should be fixable by UN-hijacking that AOMEI Backupper drivers from Windows driver. I just don't know how to do it and I have no idea why we are arguing about it...
     
  11. Krager

    Krager MDL Senior Member

    Jan 9, 2017
    396
    233
    10
    I don't have any advice on repairing Windows for you, just talking about my experience with that kind of thing.

    Sometimes you need to know when to cut bait with Windows. I come from a time when it wasn't rare for Windows to blow up for no apparent reason and require a reload. Fortunately Windows is hugely more reliable now.

    Still I use the routine I formulated long ago and it does come in handy when I want to experiment with risky stuff. Actually that happened recently with Samsung Magician SSD software. Installing and removing it changed a whole bunch of stuff on my computer it should not have. There's something seriously sketchy with that software.

    Anyway I always set up a fast reload routine, use an unattended install and script all of my settings. I keep all of my data on a separate drive and that gets synced with backup drives. Still saves my butt once in a while. Don't need any convoluted backup or imaging software. Something goes south I just reload Windows then install software and restore settings from the data drive.

    Takes me about an hour to restore everything back the way it was. Still probably a lot faster to restore an image, but not as flexible. Hardware or software changes can obsolete an image. Though I can sync my backup drives really quick compared to doing a full disk image so I make up some time there.
     
  12. whitestar_999

    whitestar_999 MDL Addicted

    Dec 9, 2011
    713
    318
    30
    @MonarchX try wilders forum,they have many backup software specialists there.
     
  13. MonarchX

    MonarchX MDL Expert

    May 5, 2007
    1,732
    313
    60
    The Wilders forums are awesome. It appears I had to remove only specific driver entries within UpperFilter reigistry entries. Now the driver is gone file-wise and registry-wise! Experts saved the day!
     
  14. dasag

    dasag MDL Junior Member

    Mar 9, 2014
    67
    9
    0
    @MonarchX ... please could you be more specific which registry entries you deleted. i i am still getting bsod when i delete related keys.
    thanks
     
  15. dasag

    dasag MDL Junior Member

    Mar 9, 2014
    67
    9
    0
    Problem solved. I found the related UpperFilters here and deleted them..

    Storage Volumes
    Class = Volume
    ClassGuid = {71a27cdd-812a-11d0-bec7-08002be2092f}

    Restarted then deleted all instances of ambakdrv.

    Restarted again and no BSOD. The rogue drivers are gone. :):p:D:rolleyes:

    Thanks
     
  16. MonarchX

    MonarchX MDL Expert

    May 5, 2007
    1,732
    313
    60
    Sorry I couldn't respond faster!
     
  17. dasag

    dasag MDL Junior Member

    Mar 9, 2014
    67
    9
    0
    A clarification of the above... In the related UpperFilters "ambakdrv" is bundled with "volsnap" which is a legitimate windows driver and other imaging programs such as Macrium won't work without it,

    Better to just remove the "ambakdrv" component from the UpperFilters if you use Macrium Reflect.

    @MonarchX .. Thanks